TWI470566B - Information security synchronous monitor single account system - Google Patents

Description

Information Security Single Account Synchronization Monitoring System

The invention relates to an information security single account synchronization monitoring system, in particular to a centralized management and synchronous monitoring of an information security account for an account of a plurality of host systems.

With the current introduction of more and more workflows into the electronic organization, the internal information system has become increasingly large, and based on the simplified account management considerations, generally use the account centralized management system, such as: Active Directory, NIS.. Etc., to centrally manage each user account.

The account centralized management system mainly provides an account application pipeline and stores all accounts in the account database to verify the legality of the account used by the user. However, the traditional centralized account management system can only perform centralized management and legality verification for authorized accounts. For unauthorized accounts, it cannot be detected and blocked in time, so it cannot maintain the confidentiality and integrity of enterprise resources in information security. With availability.

Therefore, in order to avoid the threat of unauthorized resources threatening enterprise resource information in account management, first of all, each user must be associated with its operational actions and be responsible for their actions. In order to achieve this goal, each user must be required to use the internal host system resources with a unique set of accounts and passwords, that is, to manage a single account.

According to data released by the US Host Emergency Response Team Coordination Center (CERT/CC), Vulnerability has grown exponentially in recent years, which gives intruders more opportunities to penetrate the internal hosts of the gold industry and establish illegal activities. Leave the backdoor behind the account number so that you can use this unauthorized account to access confidential information, modify the content of the data, or delete the data. Therefore, managers must strictly monitor each host system under their jurisdiction to see if there is an unauthorized illegal transaction account and then delete it.

What the preceding paragraph describes is the threat of external intruders, but it is easier to overlook the internal security issues of internal employees. After the user transfers or leaves the company, all the accounts they belong to should be deleted immediately to avoid retaining the original access rights. If the user can still use this stranded account for illegal access, the account will be regarded as an unauthorized account. Enterprise resource information security Threat. Therefore, managers must also strictly monitor and monitor the retention account of each transferred or resigned user for each host system under their jurisdiction.

In addition, auditors must be able to generate information security statements at any time in order to monitor information security status and investigate information security incidents in the future. Account management operations such as: add, delete, pause, and reuse accounts, etc., and various abnormal events such as: when checking out unauthorized accounts, you must use the audit system to record these events. Ensure that the integrity and correctness of the data is in the audit log.

Therefore, in order to comply with the purpose of information security account management, illegal account synchronization monitoring, stranded account synchronization monitoring, and recording of operational events and abnormal events in the auditing system, these information security operations are also required by management personnel.

However, in the above-mentioned information security operations of the account management system, the administrator must still manually check the files one by one and delete them immediately when an unauthorized account is found. However, with the expansion of the information architecture, the number of users and host systems has also increased. At this time, if managers still use a large amount of manpower and time to manage information security accounts, it will be very cumbersome and inefficient.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally successfully developed and completed this information security single account synchronization monitoring system.

[Object of the Invention]

The purpose of the invention is to automatically synchronize the monitoring of the illegal transaction account, the automatic synchronization monitoring of the detained account after the employee is transferred or after leaving the company, and automatically record the operations and abnormal events in the auditing system.

The information security single account synchronization monitoring system for achieving the above object includes an account monitoring module, an organization human resource module, a legal account list repository, an audit module, a network distribution module, and an account monitoring agent module. The account monitoring module is accessed through access The legal account list repository and the organization human resource module are used to synchronously monitor illegal transaction accounts and employee retention or post-employment retention accounts. The organization human resources module is used to store and regularly update the employee basic data and unit data of the enterprise organization human resource system. The legal account list repository is used to centrally store the management data and legal status required by the information security account synchronization monitoring system disclosed in the present invention. The audit module is used to record operational events and abnormal events, and is stored in the protected storage device after the signature to ensure the integrity and correctness of the audit data. The network offloading module is an intermediary device that covers all host systems in the subnet domain that are segmented and transmits account management commands across subdomains.

Because the current organization information architecture often requires multiple heterogeneous operating platforms for different needs, commonly used: Windows, Unix, and Linux. However, the account management methods of these heterogeneous operating platforms are not fully compatible, so an account monitoring proxy module must be provided for each operating platform. The various account monitoring agent modules only have different account operation commands in various operating platforms, and the basic functions are the same, including: checking whether the account on the host system has an illegal transaction account.

The invention is obviously different from the conventional account management system in that the invention utilizes the account monitoring module to achieve automatic synchronization monitoring of the illegal transaction account, and uses the centralized management repository and the organization human resource module to reach the employee retention account after leaving the job or leaving the post. Automatic synchronization monitoring, and finally through the network distribution module, Windows account management agent module, Unix account management agent module, and Linux account management agent module to achieve automatic synchronization of multiple host system accounts, in addition to using the audit module After the signature, the operation events and abnormal events are recorded to ensure the integrity and correctness of the audit data. Therefore, the technology proposed by the present invention can be easily combined with the change without the ordinary knowledge in the technical field of the invention.

Referring to FIG. 1 , a preferred embodiment of the present invention includes: an account monitoring module 2, an organization human resource module 3, a legal account list repository 4, an audit module 5, a network distribution module 6, and an account number. Monitoring agent module 7. The account monitoring module 2 is used to access the legal account list repository 4 and the organization human resource module 3 to synchronously monitor the illegal transaction account and the post-employment or post-employment account. Among them, the illegal monitoring of the illegal transaction account, due to the simultaneous inspection of all the accounts of all the host systems, will cost the account monitoring module 2 a large number of systems Resources and network bandwidth, so the system adopts the account monitoring agent module to check whether the account is illegal or not. When the illegal transaction occurs, the account monitoring module 2 compares the legal account list repository 4 and Check the illegal transaction account and synchronize processing to reduce the system resources and network bandwidth spent by the account monitoring module 2. The organization human resources module 3 is used to access the basic information and unit data of the staff of the gold industry organization human resources system, and to store and update regularly. The legal account list repository 4 is used to centrally store the management data and legal status required by the system disclosed in the present invention. The audit module 5 is used to accept records of operations and abnormal events, and is stored in the protected storage device after the signature to ensure the integrity and correctness of the audit data. The network offloading module 6 is an intermediary device for covering all host systems in the divided subdomain and transmitting account management commands across subdomains. When the network offload module 6 receives the account transaction command transmitted by the account monitoring module 2, the target host system code in the transaction command needs to be parsed and transmitted to the corresponding host system 11 in the subdomain, where the subdomain is Includes real domains and virtual domains. The account monitoring agent module 7 is configured to perform various heterogeneous job platform account transaction commands on the host system 1 and periodically check whether the account on the host system 11 is in an illegal transaction account, and when the situation occurs, the host system is located. The account number and password of 11 are transmitted to the account monitoring module 2 to check the illegal transaction account. It should be noted that the account monitoring agent module 7 of the host system 11 disclosed in the present invention is not limited, and any equivalent modification of the basic functions of the account monitoring agent module 7 provided by the present invention on other operating platforms may be The changes are not departing from the spirit and scope of the invention and are included in the scope of the appended claims.

In order to better understand the information security single account synchronization monitoring system disclosed in the present invention, the following will respectively explain how the invention achieves synchronization monitoring of illegal transaction accounts, synchronous monitoring of employee transfer or post-employment retention, and various operations and abnormal events. Documented in the audit system.

Please refer to FIG. 2 , which illustrates that the method for synchronously monitoring the illegal transaction account can be clearly focused. Therefore, the network offload module 6 in FIG. 1 is omitted, and actually must be transmitted through the network offload module 6 . However, since the synchronization of the illegal transaction account at any time will cost a lot of system resources and network bandwidth, the preferred embodiment of the present invention adopts a timing synchronization monitoring mode. That is, the illegal transaction account is monitored at intervals and synchronized as needed. As shown in FIG. 2, when the host system 11 is first connected to the system, the account monitoring agent module 7 performs an initialization operation. This action is performed by the account summary generating unit 33 to read the system account password data 34 on the host system 11, and then all the account passwords are calculated one by one by a hash function to generate a new account summary 36. Then, the account monitoring agent module 7 transmits the new account password summary 36 and the system account password data 34 to the account monitoring module 2, and then the account monitoring module 2 stores the new account summary 36 and the system account password data 34 separately. The host system old password summary 31 and the host system default account list 32 of the legal account list repository 4, wherein the host system old password summary 31 is used to store the host system old account summary, and the list includes at least the identifiable host system name. And the old account summary, etc.; the host system default account list 32 is used to store a preset account list of the host system, and the preset account is an account created on the host system required to execute a service or application, and This list contains at least the identifiable host system name, the default account name, and so on. After the initialization of the host system 11 is completed, the administrator performs a preset account screening action and deletes the preset account that is not required. After the initialization and management personnel filter the preset account action, the host system 11 is in the online state. After the host system 11 is in the online state, the timed account summary checking unit 35 in the account monitoring agent module 7 will generate all new passwords by the account summary generating unit 33 one by one at intervals of one minute at a time interval to generate a new one by a hash function. The account summary 36, and simultaneously accesses the host system old password summary 31 of the legal account list repository 4 through the account monitoring module 2, and then compares the new account summary 36 with the host system old password summary 31. When the comparison result is the same, it means that there is no change in the account password on the host system 11, so no processing will be done and the next check procedure will be awaited. However, if the comparison result is different, it means that the account password on the host system 11 has been changed. At this time, the account monitoring agent module 7 transmits the local account list on the host system 11 to the account monitoring module 2. Then, the account monitoring module 2 accesses the user account and host system relationship list 21 of the legal account list repository 4 and the host system preset account list 32, and combines them into a legal account list of the host system 11, and then the account number ratio. The unit 30 compares the local account list of the host system 11 with the legal account list of the host system 11 one by one. When the host system local account list and the main When the legal system account list is compared with the inconsistent account, the account is an illegal transaction account, and the account synchronization unit 23 of the account monitoring module 2 will perform an account on the host system 11 according to the legal account list recorded in the legal account list repository 4. Synchronization management, that is, transmitting and deleting the account command to the account monitoring agent module 7. Therefore, with the above account monitoring agent module 7 account transaction check program, it is possible to regularly monitor whether there is an illegal transaction account on each host system. The illegal transaction account that can be processed in the preferred embodiment of the present invention includes an abnormal event such as an intruder infiltrating the internal information structure, an abnormal event such as an account added directly by the administrator directly to the host system through the operation of the system, and a management personnel accidentally deleting the host system. An account on the account and the password of the user to modify the account on the host system. It should be noted that the account monitoring agent module account checking interval of the preferred embodiment is 1 minute, but the interval is a modifiable system variable, that is, the manager can adjust according to actual needs without affecting the spirit of the present invention. category.

As for the method of synchronously monitoring the employee's transfer or resignation after leaving the company, as shown in FIG. 3, the same can be clearly focused on the method description, so the network shunt module 6 in FIG. 1 is omitted. However, since the simultaneous monitoring of the employee's transfer or the retiring account after leaving the company will also cost a lot of system resources and network bandwidth, the preferred embodiment of the present invention also adopts synchronous monitoring at the same time, that is, monitoring the employee transfer at intervals. Or stay in the account after leaving the company and process it as needed. First, the timed employee unit checking unit 37 of the account monitoring module 2 will periodically access the user account list 19 from the legal account list repository 4 at intervals of one hour, and then access the employee through the organization human resource module 3. Unit data 38, in which employee unit data 38 is used to record the information of all units attached to all employees within the organization. When it is found that a user account has no information in the employee unit data 38, the employee has left the company; if the employee unit data 38 does not match the unit data in the legal account list repository 4, the employee is The situation has been transferred. This user account is considered a detained account regardless of whether the employee has been transferred or resigned. The account monitoring module 2 will further query the user account and host system relationship list 21 of the legal account list repository 4 which host systems 11 have the resident account, and perform account numbers on the plurality of host systems 11 through the account synchronization unit 23. Synchronous management, that is, the delete account command is transmitted to the account monitoring agent module 7 of the plurality of host systems 11, and finally the account monitoring agent The module 7 performs an action of deleting an account. In this way, it is possible to check whether all users have transferred or resigned in the human resources data at a fixed time interval, so as to achieve regular monitoring of whether the organization has a detained account generated by employee transfer or resignation. It should be noted that the organization human resource inspection interval of the preferred embodiment is 1 hour, but the interval is a modifiable system variable, that is, the manager can adjust according to actual needs without affecting the spirit and scope of the present invention.

The present invention also provides a method for automatically recording operational events and abnormal events in an auditing system. As shown in FIG. 4, the account monitoring module 2 includes an audit writing unit 40, and the audit module 5 includes an audit core unit 42 and an audit storage medium 43. The operating program is that the account abnormality event detected by the account monitoring module 2 is transmitted to the audit core unit 42 through the audit writing unit 40. After the signature of the event to be recorded is verified by the audit core unit 42, together with the event form, time and date, operator type, operator account number, transaction source, and transaction event, the audit storage medium 43 is used, wherein the audit storage medium 43 is used. To store audit data, it can be a protected file or database.

As described above, the information security single account synchronization monitoring system disclosed in the present invention is not limited to being implemented in hardware, software, firmware, or a mixed use manner.

[Features and effects]

The information security single account synchronization monitoring system provided by the invention has the following advantages when compared with other conventional technologies:

1. The present invention can provide an account synchronization monitoring of a plurality of host systems that meet the information security standards and are efficient.

2. The invention saves management manpower and time under the information structure of many users and the host system, so that the enterprise will reduce the cost of information security operation and the cost of information security loss.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

In summary, this case is not only innovative in terms of technical thinking, but also has a traditional way of learning. The above-mentioned multiple functions that are beyond the reach of the law have fully complied with the statutory invention patent requirements of novelty and progressiveness. If you apply in accordance with the law, you are requested to approve the application for the invention patent in order to encourage the invention.

2‧‧‧ Account Monitoring Module

3‧‧‧Organization of Human Resources Module

4‧‧‧ legal account list repository

5‧‧‧ audit module

6‧‧‧Network shunt module

7‧‧‧ Account Monitoring Agent Module

11‧‧‧Host system

21‧‧‧User account and host system relationship list

23‧‧‧ Account Synchronization Unit

30‧‧‧ account comparison unit

31‧‧‧Summary of the old account of the host system

32‧‧‧Host system default account list

33‧‧‧ Account Summary Generation Unit

34‧‧‧System account password information

35‧‧‧Timed Account Summary Check Unit

36‧‧‧New Account Summary

37‧‧‧Timed Staff Unit Inspection Unit

38‧‧‧Employee data

40‧‧‧ audit writing unit

42‧‧‧ audit core unit

43‧‧‧ audit storage media

The following is a detailed description of the present invention and its accompanying drawings, and the technical contents of the present invention and the functions thereof are further understood. FIG. 1 is a schematic diagram of the information security single account synchronization monitoring system of the present invention; FIG. The information security single account synchronization monitoring system periodically monitors the account and checks the illegal account mode diagram; FIG. 3 is a schematic diagram of the information security single account synchronization monitoring system timing monitoring account and checking the detained account mode; and FIG. 4 is the information security single account Schematic diagram of the audit operation events and abnormal events of the synchronous monitoring system.

2‧‧‧ Account Monitoring Module

4‧‧‧ legal account list repository

7‧‧‧ Account Monitoring Agent Module

11‧‧‧Host system

21‧‧‧User account and host system relationship list

23‧‧‧ Account Synchronization Unit

30‧‧‧ account comparison unit

31‧‧‧Summary of the old account of the host system

32‧‧‧Host system default account list

33‧‧‧ Account Summary Generation Unit

34‧‧‧System account password information

35‧‧‧Timed Account Summary Check Unit

36‧‧‧New Account Summary

Claims (6)

An information security single account synchronization monitoring system for synchronizing and monitoring the account of a plurality of host systems for the information security account, refers to the synchronous synchronization monitoring of illegal transaction accounts, the timing synchronization monitoring of the detained accounts after employee transfer or separation, and the operation and abnormality The event auditing system record includes: an account monitoring module, which is used to compare the legal account list repository and find the illegal transaction account of the host system, and periodically check all user affiliated employees through the organization human resource module and find After the transfer or resignation of the detained account, the account transfer agent command is transmitted to the account monitoring agent module of the illegal transaction account and the detained account, wherein the account monitoring module includes: an account comparison unit for using the account monitoring agent module All the account passwords transmitted are compared to the legal account list one by one. If the comparison result is different, it is regarded as an illegal transaction account; when necessary, the employee unit inspection unit is used to store the inventory from the legal account list at intervals. Take a list of user accounts and then pass them one by one The human resources module accesses the employee unit data to check whether it is an already transferred or resigned employee. When a user account is found to be transferred or resigned, it is regarded as a stranded account; an account synchronization unit is used to compare the account number. The illegal transaction account checked by the unit and the detained account checked by the timed employee unit inspection unit are synchronously transmitted to the account monitoring agent module according to the legal account status of the legal account list repository, that is, the transmission deletion is performed. The account number, the new account number, or the modify account password command is sent to the corresponding target host system; and an audit write unit is used to check the illegal transaction account and the timed employee unit check unit included in the account comparison unit. The abnormal event of the stranded account is transmitted to the core module of the audit. The record includes the event form, time and date, source of the abnormal event, and description of the abnormal event. An organization human resource module is used to access the employee of the enterprise organization human resource system. Unit data, and storage and timing updates; a legal account list storage Library, centralized storage system to the system disclosed in the information security The management data and legal status required for the account synchronization monitoring system; an audit module is used to accept records of operations and abnormal events, and is stored in the protected storage device after the signature, and when reviewing the audit records, Verifying the signature to ensure the integrity and correctness of the audit data; a network shunt module is used to cover all host systems in the subnet domain that is segmented, and to transfer the account management commands across sub-domains; and The account monitoring agent module is used to periodically check whether the account on the host system has an illegal transaction account, and when the situation occurs, the account and password of the host system are transmitted to the account monitoring module to check the illegal transaction. The account, wherein the account monitoring agent module comprises: an account summary generating unit, configured to read the account password data on the host system, and then calculate all the account passwords one by one by a hash function to generate a new account summary; The timed account summary check unit is used to summarize all account passwords by account at intervals. The unit generates a new account summary, and simultaneously accesses the old account summary of the host account list in the legal account list repository through the account monitoring module, and then compares the new account summary with the host system old account summary, if the comparison result does not match, It means that the account of the host system is illegally changed, and when this happens, the host system local account list is transmitted to the account monitoring module to check the illegal transaction account. For example, the information security single account synchronization monitoring system described in claim 1 of the patent scope, wherein the organization human resource module includes: an employee unit data, which is used to record information of all units belonging to all employees within the organization. For example, the information security single account synchronization monitoring system described in claim 1 wherein the legal account list repository includes: a user account list for storing user account related data, and the list includes at least identifiable User account name, employee number, email account, encrypted account password, and expiration date of the account; A user account and a host system relationship list is used to store information related to the establishment relationship between the user account and the host system, that is, a user account is established on a host system, and the list includes at least an identifiable user. Account number, identifiable host system code, and enabled status; a host system old account summary is used to store the host system old account summary, and the list includes at least the identifiable host system code and the old account summary; The host system preset account list is used to store a preset account list of the host system, and the preset account is an account established on the host system required to execute a service or application, and the list includes at least an identifiable account. Host system name, and default account name. For example, the information security single account synchronization monitoring system described in claim 1 wherein the audit module includes: an audit core unit for signing the event to be recorded, together with the event form, time and date, The operator type, operator account number, transaction source, and transaction event description are stored in the audit storage medium; and an audit storage medium is used to store the audit data, which may be a protected file or database. The information security single account synchronization monitoring system described in claim 1, wherein the network distribution module comprises: a host system corresponding unit, configured to resolve the target host system code in the account transaction command, and The command is passed to the host system. For example, the information security single account synchronization monitoring system described in claim 2, wherein the account matching unit is used to compare the legal account list including: a user account and a host system relationship list and a host system preset account list. .